Last updated: 19 July 2026. This policy describes how Lacunr processes personal data. It is written for operational clarity; for jurisdiction-specific advice, consult qualified counsel.
1. Who we are
Lacunr is a clinical decision-support / report-drafting web application for radiologists. Controller contact: support@lacunr.com. Postal address, when published, appears on the Contact page.
2. Data we process
- Account data — identifiers from our authentication provider (e.g. email, user id) and access flags for entitlements.
- Clinical text you submit — the case descriptions, dictations, gap-intake answers, and any report drafts you generate. You must submit de-identified data only — do not enter patient names, IDs, or other identifiers (see Disclaimer §4).
- Chats & report drafts — saved to your account so you can return to them. Removable via the self-serve controls in section 9.
- Uploaded images (if used) — processed to produce a supplementary read; you are responsible for removing patient identifiers before upload.
- Support messages — name, email, topic, message, and basic technical metadata (time, approximate IP) for abuse prevention.
- Technical logs — device/browser signals, IP address, timestamps, and error logs needed to operate, secure, and debug the service.
3. Purposes and legal bases
- Provide the service you request (drafting, gap intake, analysis) — contract / service delivery.
- Authenticate you and protect accounts — legitimate interests / security.
- Process payments and prevent fraud — contract and legal obligations.
- Respond to support and privacy requests — contract / legal obligations.
- Maintain security, prevent abuse, and improve reliability — legitimate interests.
- Comply with law, regulators, or valid legal process — legal obligation.
4. AI processing
Reports and suggestions are generated using third-party AI model providers (e.g. Anthropic, OpenAI, Groq). The clinical text and prompts necessary to produce an output are transmitted to those providers under their terms and our agreements with them. Do not submit patient-identifiable data, others’ personal data, or sensitive information in free text unless it is de-identified and you accept it may be processed to answer you.
5. Sharing
- Authentication provider (account sign-in).
- Payment processor (if/when paid plans are enabled).
- Hosting, database, and infrastructure providers.
- AI providers used to generate the outputs you request.
- Professional advisers or authorities when legally required.
We do not sell your personal data.
6. Retention
We retain account, chat, draft, and support records for as long as needed to provide the service, meet legal/accounting requirements, resolve disputes, and enforce policies. You may delete your chats and drafts at any time via section 9.
7. Security
We use industry-standard safeguards appropriate to a web application: encrypted transport (HTTPS/TLS), access controls, least-privilege keys, security response headers, and per-user rate limiting. No method of transmission or storage is 100% secure. If we ever become aware of a personal-data breach that is likely to cause harm, we will act in line with applicable breach-notification law and, where required, notify affected users and the relevant authority.
8. International transfers
Service providers may process data in India and other countries. Where required, we rely on appropriate contractual or legal transfer mechanisms offered by those providers.
9. Your rights — self-serve export & deletion
You can export or delete your server-side data (chats and report drafts) yourself, right here, while signed in. Full account (sign-in) deletion and anything not covered by the buttons below: contact support@lacunr.com — we may need to verify your identity before acting.
to export or delete the data stored for your account.
Depending on your location, you may also have rights to access, correct, restrict, or object to certain processing, and to withdraw consent where processing is consent-based.
10. Grievance / data-protection contact
For privacy questions, complaints, or to exercise your rights under the Indian DPDP Act, GDPR, or other applicable law, contact our grievance/redressal point: grievance@lacunr.com. We aim to acknowledge requests promptly and to respond within the timelines required by applicable law.
11. Children
The service is intended for qualified clinicians and is not directed to children. Do not use it to process a child’s identifiable data outside a lawful clinical basis.
12. Cookies and similar tech
We use essential cookies/storage for authentication, preferences (e.g. theme), and security. Analytics, if added later, will be described here or via an updated notice.
13. Changes
We may update this policy. Material changes will be reflected by updating the “Last updated” date and, where appropriate, additional notice in the product.
14. Contact
Privacy requests: support@lacunr.com. Also see Support.